[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$faZgNuU4a3oWTf3rSCJSr_DccC2LNTlmsY0Ut1O00nn8":3},{"article":4,"iocs":48,"watch_terms":66,"solutions":67,"lesson":157},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":32,"category":33,"article_tags":37},"b1200d0c-2818-4d21-99da-9ff09b721925","New phishing kits target Microsoft 365 accounts, evade MFA","new-phishing-kits-target-microsoft-365-accounts-evade-mfa-4a1fc4","Two new phishing kits, Jalisco and OmegaLord, have been discovered in attacks targeting Microsoft 365 accounts, using techniques that defeat multi-factor authentication (MFA). [...]","Researchers at ReliaQuest discovered two new phishing kits—Jalisco and OmegaLord—designed to compromise Microsoft 365 accounts while defeating multi-factor authentication. Jalisco exploits the OAuth 2.0 Device Authorization Grant flow to trick users into authorizing attacker-controlled devices, while OmegaLord masquerades as a PDF reader to steal credentials and phone numbers. Both toolkits represent evolving phishing tactics that directly target MFA protections, with attackers exfiltrating sensitive data from compromised accounts in minutes.","Two phishing kits, Jalisco and OmegaLord, target Microsoft 365 accounts with MFA-bypass techniques.","https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fnew-phishing-kits-target-microsoft-365-accounts-evade-mfa\u002F","https:\u002F\u002Fwww.bleepstatic.com\u002Fcontent\u002Fhl-images\u002F2026\u002F05\u002F15\u002FMS365.jpg","2026-07-14T12:49:00+00:00","2026-07-14T14:00:18.052408+00:00",9,[17,20,22,24,27,30],{"name":18,"type":19},"Microsoft 365","product",{"name":21,"type":19},"Microsoft Entra ID",{"name":23,"type":19},"Okta",{"name":25,"type":26},"ReliaQuest","vendor",{"name":28,"type":29},"OAuth 2.0 Device Authorization Grant","technology",{"name":31,"type":29},"SharePoint","2c8f44d4-b56e-47cf-9677-04f22c9ee78d",{"id":32,"icon":34,"name":35,"slug":36},null,"Identity & Access","identity-access",[38,43],{"category":39},{"id":40,"icon":34,"name":41,"slug":42},"574f766a-fb3f-487c-8d2c-0720ae75471b","Zero-day","zero-day",{"category":44},{"id":45,"icon":34,"name":46,"slug":47},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",[49,52,55,58,60,62,64],{"type":47,"value":50,"context":51},"Jalisco","Phishing kit exploiting OAuth 2.0 Device Authorization Grant to bypass MFA on Microsoft 365",{"type":47,"value":53,"context":54},"OmegaLord","Phishing kit masquerading as PDF reader to steal credentials and phone numbers for MFA bypass",{"type":47,"value":56,"context":57},"EvilTokens","Related phishing kit using device-code phishing method",{"type":47,"value":59,"context":57},"Kali365",{"type":47,"value":61,"context":57},"Tycoon2FA",{"type":47,"value":63,"context":57},"Venom",{"type":47,"value":65,"context":57},"Forg365",[25,18,21],{"controls":68,"vendors":148},[69,96,119],{"slug":70,"name":71,"problem":72,"products":73},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",[74,81,89],{"vendor_slug":75,"vendor_name":23,"vendor_logo":76,"product_slug":77,"product_name":78,"url":79,"description":80},"okta","\u002Fvendor-logos\u002Fokta.png","workforce-identity","Okta Workforce Identity","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fworkforce-identity\u002F","Single sign-on, adaptive MFA including phishing-resistant methods, and lifecycle management for employees.",{"vendor_slug":82,"vendor_name":83,"vendor_logo":84,"product_slug":85,"product_name":86,"url":87,"description":88},"yubico","Yubico","\u002Fvendor-logos\u002Fyubico.png","yubikey","YubiKey","https:\u002F\u002Fwww.yubico.com\u002Fproducts\u002F","Hardware security keys for FIDO2, passkeys and smart card login, in USB and NFC versions.",{"vendor_slug":90,"vendor_name":91,"vendor_logo":92,"product_slug":93,"product_name":21,"url":94,"description":95},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","entra-id","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fidentity-access\u002Fmicrosoft-entra-id","Cloud identity and access management with single sign-on, conditional access, passkeys and identity governance.",{"slug":97,"name":98,"problem":99,"products":100},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[101,109,114],{"vendor_slug":102,"vendor_name":103,"vendor_logo":104,"product_slug":105,"product_name":106,"url":107,"description":108},"acalvio","Acalvio","\u002Fvendor-logos\u002Facalvio.png","shadowplex-identity-protection","ShadowPlex Identity Protection","https:\u002F\u002Fwww.acalvio.com\u002Fproducts\u002Fidentity-protection\u002F","Decoy accounts and credentials that expose identity attacks and credential misuse early.",{"vendor_slug":90,"vendor_name":91,"vendor_logo":92,"product_slug":110,"product_name":111,"url":112,"description":113},"defender-for-identity","Microsoft Defender for Identity","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fsiem-and-xdr\u002Fmicrosoft-defender-for-identity","Detects attacks against on-premises Active Directory and hybrid identities.",{"vendor_slug":75,"vendor_name":23,"vendor_logo":76,"product_slug":115,"product_name":116,"url":117,"description":118},"identity-threat-protection","Okta Identity Threat Protection","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fidentity-threat-protection\u002F","Continuous risk assessment of sessions after login, with automatic actions such as ending sessions.",{"slug":120,"name":121,"problem":122,"products":123},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",[124,132,140],{"vendor_slug":125,"vendor_name":126,"vendor_logo":127,"product_slug":128,"product_name":129,"url":130,"description":131},"abnormal","Abnormal AI","\u002Fvendor-logos\u002Fabnormal.png","abnormal-email-security","Abnormal Inbound Email Security","https:\u002F\u002Fabnormal.ai\u002F","API-based email security for Microsoft 365 and Google Workspace using behavioural models.",{"vendor_slug":133,"vendor_name":134,"vendor_logo":135,"product_slug":136,"product_name":137,"url":138,"description":139},"check-point","Check Point","\u002Fvendor-logos\u002Fcheck-point.png","harmony-email","Harmony Email & Collaboration","https:\u002F\u002Fwww.checkpoint.com\u002Fharmony\u002Femail-security\u002F","Email and collaboration security for Microsoft 365 and Google Workspace.",{"vendor_slug":141,"vendor_name":142,"vendor_logo":143,"product_slug":144,"product_name":145,"url":146,"description":147},"darktrace","Darktrace","\u002Fvendor-logos\u002Fdarktrace.png","darktrace-email","Darktrace \u002F EMAIL","https:\u002F\u002Fwww.darktrace.com\u002Fproducts\u002Femail","Email security that flags messages deviating from normal communication patterns.",[149,152],{"slug":90,"name":91,"logo_path":92,"roles":150},[151],"affected",{"slug":153,"name":25,"logo_path":154,"roles":155},"reliaquest","\u002Fvendor-logos\u002Freliaquest.png",[156],"reported_by",{"slug":158,"title":159,"body":160,"framework_refs":161,"framework_notes":175},"phishing-kits-bypass-mfa-to-compromise-microsoft-365-accounts","Phishing Kits Bypass MFA to Compromise Microsoft 365 Accounts","Attackers have developed sophisticated phishing kits that specifically circumvent multi-factor authentication, long considered a strong defensive baseline. Jalisco abuses the legitimate OAuth 2.0 Device Authorization Grant flow to trick users into granting access to attacker-controlled devices, while OmegaLord harvests credentials and phone numbers by impersonating a PDF reader. These kits demonstrate that MFA alone is not a silver bullet—user awareness and stricter authentication controls are equally critical. The speed of data exfiltration (within minutes of compromise) underscores the need for real-time detection and rapid incident response capabilities.",[162,163,164,165,166,167,168,169,170,171,172,173,174],"CIS Control 4 – Secure Configuration of Enterprise Assets","CIS Control 6 – Access Control Management","CIS Control 14 – Security Awareness and Skills Training","CIS Control 16 – Application Software Security","NIST SP 800-63B – Digital Identity Guidelines (Phishing-Resistant AAL3)","NIST AC-2 – Account Management","NIST AC-17 – Remote Access","NIST SI-10 – Information Input Validation","NIST IR-4 – Incident Handling","MITRE ATT&CK T1528 – Steal Application Access Token","MITRE ATT&CK T1566 – Phishing","GDPR Article 32 – Security of Processing","ITIL 4 – Service Security Management (Threat & Vulnerability Practice)",{}]